fix(agent): scope subdirectory hint discovery to active workspace boundary

[Tranquil-Flow]

What does this PR do?

Post-tool-call path discovery scanned any directory for AGENTS.md, CLAUDE.md, and .cursorrules files, even those outside the intended workspace. A tool call touching a file elsewhere on disk could silently inject unrelated instruction files into the agent context, causing unexpected behavior drift and cross-project leakage.

Related Issue

Fixes #14471

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• agent/subdirectory_hints.py: Scoped discovery to active workspace boundary
• tests/agent/test_subdirectory_hints.py: 26 tests

How to Test

python -m pytest -o 'addopts=' tests/agent/test_subdirectory_hints.py -v

Result: 26 passed.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15 (Darwin 24.6.0), Python 3.14.2

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

python -m pytest -o 'addopts=' tests/agent/test_subdirectory_hints.py -v
26 passed

[alt-glitch]

Related to #14471 (issue) and #14510 (competing fix PR) — cross-workspace instruction file injection via unbounded subdirectory hint discovery.

[egilewski]

requesting changes

The PR widens the boundary from the active working_dir to the containing git root, which leaves a residual prompt-injection path when Hermes is operating from a subdirectory inside a larger repository. In that setup, a tool call touching a sibling directory under the same git root can still load that sibling's AGENTS.md into the agent context.

I reproduced this with a synthetic git repo containing workspace/ as the active working_dir and sibling/AGENTS.md outside that active workspace. Loading agent/subdirectory_hints.py from current main returned None, but loading the PR head returned:

pr_head: loaded_sibling_hint=True result='... [Subdirectory context discovered: .../sibling/AGENTS.md]\nSIBLING INSTRUCTIONS'

The cause is that PR head sets _workspace_root to git rev-parse --show-toplevel when available (SubdirectoryHintTracker.__init__), and _add_path_candidate() only checks paths against that git root. The PR tests pass, but they do not create a git repository around a nested working directory, so they only exercise the fallback where _workspace_root == working_dir.

Security evidence:

• trust boundary: post-tool-call discovery of AGENTS.md / CLAUDE.md / .cursorrules from tool path arguments.
• source/sink/invariant: untrusted tool path argument to appended subdirectory context; invariant should be no hint files outside the active workspace/working directory.
• current-main reproduction: current main 03d9a95a74b234c2d46e0b59cf6e12281f93fbf5 blocked the sibling hint in the synthetic nested-workspace repo.
• PR-head validation: PR head 4056d141ddedc0e340a1e5f56c4d24c410113e24 loaded the sibling AGENTS.md.
• positive/negative cases: PR's own focused tests passed (26 passed), but the missing nested-git-root negative case reproduces the bypass.
• residual bypass search: sibling directory under same git root but outside active working_dir.
• reviewer-tool status: skipped because local review already found a decisive security bypass.

Signed: GPT-5.5-xhigh in Codex

[teknium1]

This is an automated hermes-sweeper review. Current main already implements the security boundary this PR was aiming for.

Evidence:

• agent/subdirectory_hints.py:189 rejects candidate directories outside SubdirectoryHintTracker.working_dir with path.is_relative_to(self.working_dir).
• agent/subdirectory_hints.py:207 repeats the same boundary check before reading any discovered hint file.
• tests/agent/test_subdirectory_hints.py:124 covers outside-working-directory rejection, and the current test file also covers parent/sibling rejection cases.
• The implementation landed on main in f4953bc6488e54c8a706f947d541d592b2cf08ab (fix(subdirectory_hints): prevent loading AGENTS.md outside workspace), which is contained in v2026.5.28 and later tags.

I also ran a small synthetic nested-workspace check against current HEAD: a sibling AGENTS.md outside the active working_dir returned None, so the cross-workspace hint injection path is already blocked.